[tenebrisalietum]

Try an SSL DOH resolver, which can't be subject to simple transparent intercepts (at least not without you knowing about it).